Information Management Assessment

Action plan progress review

Department for Business, Innovation and Skills

Reviewed May 2015

Published July 2015

Working with government to raise standards in information management Background

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Department for Business, Innovation and Skills (BIS) IMA took place in 2013. We conducted interviews at the department’s London offices between 13 and 17 May. BIS produced a detailed action plan and we formally assessed progress against this in May 2015. The IMA report and action plan are both published on The National Archives website.¹

This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under ‘Next Steps.’

¹ [http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/](http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/) Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2013 | Review 2015 | |--------------------|-------------------|------------------------------| | Communicating and realising value | Good practice | Good practice | | Managing information as an asset | Development area | Progressing towards satisfactory |

Situation at the time of the IMA

BIS had developed a draft Knowledge and Information Management (KIM) strategy that clearly stated why information and its effective management matters. It needed to ensure that it had the endorsement and backing of the senior team to ensure the message was heard and acted on as BIS introduced new technology, policy and ways of working. The draft strategy established the role of good information management in supporting compliance with legal, regulatory and transparency obligations. We recommended that BIS build on existing arrangements to promote transparency outcomes, and champion information in overall terms at Board level.

The department’s information asset management approach was at an early stage but had the potential to serve as a key tool to realise KIM strategy objectives.

The BIS and Partner Organisation (POs) KIM Strategy was signed off by the Operations Committee, published and endorsed by the Permanent Under Secretary, Martin Donnelly. The strategy is reviewed quarterly by the wider BIS/PO KIM Project Board for progress against actions and some POs have produced their own implementation plans. Although core BIS has not formally produced an implementation plan, we note that strategy principles are linked to KIM team priorities such as work to develop the Information Asset Register (IAR) and introduce Alfresco. A work stream has been set up to develop a new KIM strategy for 2016-2018. Although the principles that underpin the current strategy will still apply, BIS is planning to collect case studies and ensure that the new strategy is aligned with any new government agendas.

BIS is in the process of finalising work to redevelop its IAR. There is still work that can be done in order to enhance the value of the IAR as a tool for managing information assets more generally. For example, currently Alfresco is on the IAR at the system level and would be helpful to break it down to reflect the broad groupings of information within it as recommended in The National Archives' guidance. The work that BIS has done to identify owners of information in the M drive at Directorate level may help to inform this work.

The department has recently received training from The National Archives Information Assurance and Cyber Security Engagement Programme (IACSEP) team. A handbook has also been developed for Information Asset Owners (IAO) which lays out the process for managing information assets and their responsibilities. At present there are no other formally established roles that support the IAOs in this work. However, it is recognised that IAOs may delegate the day to day aspects of this work to other members of their teams. BIS would benefit from defining these support roles in a way that fits into their own organisational culture.

The BIS KIM team has recently been restructured including the recruitment of three new members of staff: a Grade 7 to oversee the Alfresco, an SEO-level KIM Project Manager and an SEO-level Records Manager who will also act as Deputy Departmental Record Officer. This new structure is designed to focus more on KIM and meet the additional requirements of records review. BIS has also done some good work to establish a KIM community across BIS and POs. A Huddle collaboration site was set up in November 2013 to share documents and hold discussions. It currently has 56 active members from across BIS and contains 30,096KB of data. In addition, the wider KIM community is working towards developing a new Centre of Excellence and developing opportunities for shared service not only across BIS and POs but also other government departments.

2 Digital information and supporting technology

| Performance rating | IMA 2013 | Review 2015 | |-----------------------------------------|------------------|----------------------------------| | Supporting information through technology | Development area | Progressing towards satisfactory | | Digital continuity and IT change | Satisfactory | Satisfactory |

Situation at the time of the IMA

BIS’s Electronic Document and Records Management system, Matrix, had delivered benefits in terms of its ability to support the protection and lifecycle management of information. However, a lack of mandate around use of Matrix and failure to meet user needs and expectations drove staff towards using shared drives. This, paired with a lack of direction on how the shared drives were to be used, led to the dispersal of the corporate record and raised a range of risks to the department and its ability to protect, manage and exploit its information.

BIS was preparing to move away from Matrix and procure a new Enterprise Content Management (ECM) solution through the Future Information Management Solution (FIMS) project and business requirements had been defined for this. The FIMS project was aligned with wider work to renew the underlying technology infrastructure which had obvious benefits but put the project under immense time pressure.

BIS has put considerable effort into ensuring that its new ECM, Alfresco, is configured in a way that meets business needs and statutory requirements. The FIMS detailed business requirements have been used from the start to guide the work. BIS also ran workshops to understand why staff did not use/did not like Matrix and what they liked about using the shared drives. BIS used this as the basis for work to configure Alfresco. There has been a conscious decision to allow staff to work in the way that is familiar to them (the file plan is hidden) but to make it easy to declare records (it is a ‘one click’ process), which will be automatically moved to an area in the file plan pre-determined by the KIM team.

BIS has also worked hard to ensure that Alfresco complies as far as possible with accessibility requirements. The department commissioned a report into what the issues were and then took this to Alfresco which developed a new version of the software addressing the majority of the points raised. BIS has done much engagement, for example, carrying out one-to-ones with those users with accessibility needs to fully understand their requirements. As part of Gateway 4 for the project it will be revisiting the various business requirements to see how far they have been met.

In terms of migration, all records from Matrix (new and old file plan) have now been migrated across to Alfresco. The KIM team identified that records within the old Matrix file plan were rarely used, and as a result has placed them in a separate instance of Alfresco which only the KIM team has access to. This frees up space in the main Alfresco system and increases efficiency by ensuring that it is only used for current records or information that need to be accessed regularly. Staff can request access to records from the old Matrix file plan via the KIM team.

BIS has worked hard to prepare the shared drives for migration to Alfresco. Seventy shared drives were rationalised onto the M drive during the move from the Elgar IT platform to the new platform, Evolve. Each business area had a new shared area on the M Drive, the top two levels of which were pre-determined, and users were encouraged to move across information that they wanted to the shared drives. Users are being asked to identify information that eventually will be migrated to Alfresco. The KIM team will then migrate these records across to Alfresco as it is being rolled out to business areas. Once migrated, there will be a period where the M drive becomes read only, is then hidden and then decommissioned. There will continue to be limited use of the shared drive for linked spreadsheets and access databases as these cannot be stored within Alfresco. Once shared drives have been turned off ‘The Only Way is Alfresco’ IT protocol, developed by the Ways of Working team will go live and there will be a more formal switch over to Alfresco. This addresses a key concern raised at the time of the IMA around policy on the shared drives and will ensure that there is a clear line on what the shared drives should/should not be used for. Floor walkers will be deployed to help staff not yet using the Alfresco. This is good practice.

There are around 2.7 terabytes of information on the M drive. Not all of this will be moved across to Alfresco. BIS has looked into de-duplication and gave their implementer, ZaaZi, a subset of data to analyse. Only about 5% of this data were found to be duplicates. They will test another set of data but it is currently felt that there would be no cost benefit to de-duplifying with such a small percentage of duplicate material. BIS has asked its supplier to carry out load testing and is relatively confident that Alfresco will cope with the volumes of information.

Email integration is being held back until after rollout of Alfresco. BIS previously had automatic deletion of emails after one year but this was stopped once Matrix was closed, as there was no official corporate records repository, and therefore nowhere to store significant emails. A paper has been written for Executive Team on the re-instigation of the one year email deletion policy and limits on P drives.

Alfresco is still yet to be rolled out, hence the marking of ‘progressing towards satisfactory.’ BIS is planning a soft launch over a period of three months taking individual business areas across to the new system. There will also be an Alfresco Showcase day for senior management to bring them fully up to speed. At the time of the progress review there were still some technical issues that needed to be addressed. It is hoped that timing for rollout will be confirmed at the Operations Committee meeting, summer 2015. 3 Information risk, governance and oversight

| Performance rating | IMA 2013 | Review 2015 | |-----------------------------|-------------------|----------------------------------| | Recognising information risk| Development area | Development area | | Establishing control | Satisfactory | Progressing towards good practice| | Providing guidance | Satisfactory | Good practice | | Measuring impact | Satisfactory | Satisfactory |

**Situation at the time of the IMA**

There was limited recognition of information risk within BIS. The profile of information needed to be elevated and key information risks recorded corporately so they could be managed and escalated as necessary. This should be understood to include risks raised by information management practice within the business, such as those resulting from a failure to manage information in accordance with its value.

Current policy and guidance was well established but there was a need to address some gaps, particularly around use of shared drives and on what to keep. There was also a need to promote and adopt new policy and guidance for knowledge and information management that reflected the new technology environment, supporting BIS to achieve its goal that ‘KIM is not an added task, it is how we work.’

BIS needed to ensure that the department’s Board could monitor progress towards KIM strategy goals and it was recommended that they define how metrics will be used to monitor information and records management practice on a business as usual basis. A range of information and records management-related risks have been defined through the FIMS risk register since the IMA. However, the department still lacks a signed off Information Risk policy, though the KIM team are working with their security colleagues to develop one. The 2008 report of the Data Handling review made it a mandatory minimum requirement for government departments to have an Information Risk policy. A Senior Information Risk Owner (SIRO) risk register has also not yet been developed but the department is in the process of pulling together a statement on information risk from the SIRO.

BIS is to be commended on its work, along with POs, to design and publish a new KIM Maturity Model. The Model was designed to achieve a common reference for current activity and to help assess future performance across BIS and its partners. The Model itself was developed by a group of KIM professionals and was launched in January 2015. POs will use the Model to self-assess where they currently sit on the maturity scale on an annual basis. This will then be used to inform discussions concerning next steps in order to make improvements. The Maturity Model was endorsed by the BIS SIRO in a write around to core BIS and PO Chief Information Officers (CIO). Thirteen responses have been received in 2015, and the KIM team is in the process of chasing those who have not yet sent in their return.

The Information Support Officer role no longer exists and new roles have been established in the business to support Alfresco. There are around 40 Senior Civil Service-level Alfresco Champions who will provide strong and positive leadership, visibility, support and strategic assurance to the Alfresco transition process across their Directorate and Department for the preparation, transition and embedding of the new Alfresco in BIS. BIS is also introducing Super Users, the ‘go to’ people for queries around the IT systems within BIS, and Site Managers who are responsible for maintenance of team sites. There are around 400 of each of these roles across BIS. The level varies and can be anything from Grade 7 to EO. Generally, staff have been assigned these roles rather than asked to volunteer and it is up to business areas who they choose to do this. Classroom-based training sessions have been

______________________________________________________________________

2 https://www.gov.uk/government/publications/guidance-on-departmental-information-risk-policy held for those taking up these roles and around half of these people have been on the training. An objective for Super Users and Site Managers, which carries equal weight with their other objectives, has been developed to include in annual performance appraisals. These roles are very new and are likely to evolve once Alfresco is rolled out and people get to grips with their responsibilities.

A new KIM Governance Board is being appointed with a remit incorporating Alfresco to provide strategic direction across BIS to enable staff to work effectively, collaboratively and efficiently with BIS’ knowledge and information in ways that support the business. This will be chaired by the Director of Regional Growth Directorate, who provides a link to the Operations Committee. Terms of reference have been agreed and a first meeting is being scheduled.

High level KPIs have been developed to monitor the success of Alfresco, for example:

- 95% of staff accessing and editing content on Alfresco
- 15% of documents and emails in Alfresco declared as records
- 95% of staff regularly declaring records
- Reduction in the size of the M drive – from 2TB to 0.5TB

The KPIs will be reported to the BIS Executive Board. This is good practice. The Alfresco project team, KIM team and ZaaZi are also working to produce an Alfresco Reporting Tool to help facilitate this process.

BIS has reviewed existing policy and guidance and incorporated them into a new Information Management Policy, which includes how the policy will enable BIS to achieve its legal obligations and support delivery of BIS’s objectives. It focuses on BIS’s IT environment and directs users towards Alfresco and away from other storage areas. They are also updating the email management policy.

A number of policies and pieces of guidance have been produced around Alfresco including guidance on what to keep and disposal. During development the KIM team consulted with UK Trade and Industry, and the Legal and Business User Group and have incorporated their views so that the guidance meets user needs and is relevant to their work processes.

BIS has reviewed and uploaded information and records management policy and guidance onto the intranet where possible. The Communications Directorate has overall control of content so there have been some limitations. Where the intranet does not allow storage of guidance material this is uploaded on the Alfresco Training and Guidance Team Site, which is available to all BIS staff.

4 Records, review and transfer

| Performance rating | IMA 2013 | Review 2015 | |------------------------------------|----------------|-------------| | Oversight of records and selection | Good practice | Good practice| | Implementing disposal decisions | Satisfactory | Satisfactory|

Situation at the time of the IMA

BIS was commended for its work to develop a methodology and process for appraisal of records and to apply retention to Matrix through the Electronic Records Appraisal (ERA) project and for the records review team’s work to oversee a smooth transition from the department’s file store, Westfield House. It was felt that BIS would benefit from defining a clear plan for review of accruing records series and agreeing this with The National Archives in order to help meet the demands of transition to the 20 Year Rule.

In order to address the issue of lack of space for paper files at their London office, BIS has explored alternative solutions for records review. A business case has now been approved for the development of a new paper records review function in Companies House, Cardiff. This function will undertake paper records review for both BIS and some of its POs.

BIS is revisiting the ERA work it did for Matrix to see if and how it can be applied to Alfresco. Although initially held up by overall delays to the implementation of Alfresco, a project has now been set up to carry this work forward.

BIS has created a new process document for the review team showing the process of transferring paper files to The National Archives from the retrieval of files from TNT through to deposit at The National Archives. BIS has been working with The National Archives to clear the backlog of files and the next Records Transfer Report should show a reduction in the amount of material awaiting transfer. Next Steps

The National Archives will continue to work closely with BIS so that the department is supported as it continues its work on information and records management. Outstanding recommendations will be reviewed at the time of the department’s IMA reassessment. It is recommended that BIS focusses on the following:

- Finalising work on the Information Risk Policy and ensure that this defines what information and records management risk means to the department.

- Developing a SIRO Risk Register and ensuring that the effect of the new ECM and new governance arrangements on risk scores can be understood and tracked.

- Continuing to work with The National Archives Information Management Consultant (IMC) to develop the IAR as a tool for managing information assets and defining roles to support IAOs. Building links between the Directorate level owners of information and the information asset governance process.

- Ensuring that shared drives are decommissioned as planned, once Alfresco has been rolled out and that other measures to such as limits on P drives and auto deletion of email are implemented.

- Reviewing the success of the new Alfresco Champion and support roles to ensure that they are meeting the needs of the organisation and making adjustments where necessary.

- Continuing work on Electronic Records Appraisal and ensure that retention periods are applied to Alfresco and material of historical value is flagged for transfer to The National Archives.

Continuing to work with their IMC on paper review, particularly around reducing backlog and developing an in year work plan for this.